CSCwa47388 Log4j incorrect fixed release version?

[mmcclure1]

The Cisco log4j advisory page shows the Contact Center Express fixed release version is 12.5(1)SU1 ES03: 23 Dec 2021, but ES03 was available as of October 2020.

Is the advisory page incorrect, or does ES03 actually mitigate the log4j vulnerability?

[ncarmichael · Accepted solution]

Hi there - it is confusing on the site. That ES03 is for 12.5.1_ES03. We are still waiting for 12.5.1_SU1_ES03 which will have the Log4j patch

[Leo Laohoo]

• Cisco Event Response: Apache Log4j Java Logging Library Security Incident
• Vulnerability in Apache Log4j Library Affecting Cisco Products